Problem with dns in Debian Etch

Hi,
I'm running bind 9.3.4.2 on four debian etch servers. Here's the setup :
Two servers are in a private network, server1 is primary master and
server3 is the slave, two are in an external network, server2 is slave of
server1 above and master for server4 (which is the external slave). All
updates of zones are made on server1, and propagated to the other servers
via a TSIG authentication, following this scheme : S1 sends notify to S3
and S2. Then S2 notifies S4.

The problem : for one of my zones (I have several), S4 doesn't update
correctly. For example, if I increment the serial and comment out a dns
record, then issue a /etc/init.d/bind9 restart, S2 and S3 update correctly
but S4 is one update late, eg it is 20070518O1 instead of 2007051802, and
so on 02 instead of 03, 03 instead of 04...

The only way to get it working is restart bind from S1 TWICE, which is
rather unexpected. For my other zones everything runs well with one
restart only.

Of course, there are no error messages. S2 sends notify to S4, S4 says
'zone is up to date', but doesn't update.

Would you have any idea of what might be going wrong ?

Thanks for your help.

PS : this is not a firewall problem : there is one fw between S1 and S2
but NOT between S2 and S4.